 Yeah, I prefer to talk from here so I can see the screen. Otherwise, I have over to give my back to you So we have a lot of microphones, you know Let's see just a second let's see if maybe I Don't need this one so this morning we are We are talking about the the safety classifications. We already introduced some Main concepts yesterday today we are going a little bit more detail and so I will present to you what is the the approach that is in the the standards of the agency to classify the The structure system and components so this is the summary of the presentation We will address the objectives of the safety classification. What is the general approach? the safety classification process the Safety functions performed by systems the design provision then I will define the design provision in detail what we Is intended in the safety standard? How the safety classes are defined? How the SSCs are assigned to a safety class and some example of applicable engineering design rules So some preliminary consideration. I mean the safety classification has been used for a long time, but at least I mean the other first statement probably is not completely true, but in the past at least the The system to classify structure system and components was quite prescriptive practically there you had a list of items and the Correspondent classification so in in the standard you you you didn't find Normally the rationale the explanation why this item is in class one Why this item in safety class two, but just was this correspondence and I mean, of course This was created on the basis of the experience and that there was some thinking Behind this but was not explicit in the industry in the in the codes so what the agency did it was also to create a system an approach to generate a scheme of safety classification, so it's quite general and you can apply this scheme also for different technologies from let's say evolutionary nuclear power plants or innovative nuclear power plants for which there is no already an Available scheme of classification because it is different than the the current technology the current practice So it's a quite general approach But it can allow you to create an independence if you want to like scheme of classification So what is the objective of the classification? I think this is everybody knows of you here, but let's Just to have a complete Presentation to recall it so the safety classification aims to identify and classify SSC's that are need to protect people and this has to be done on the basis of The importance of safety of each item. That is what we said yesterday We have to recognize that the importance to safety is not the same for everything some structure some Systems some components are more important than others. So we have to find a way to rank the importance to safety of these SSC's So the the general approach we have seen yesterday just to recall very quickly two requirements that are in the in the SSR 2 slash 1 one is what are the fundamental safety function? We already addressed this but it is important to remember because it's the starting point The starting point of the classification and then requirement 22 22 that is the requirement on safety classification and All items important to safety shall be identified and shall be classified. So this is why we are Performing the safety classification because there is a requirement addressing This so this is the starting point Then another requirement that to to remember also this we presented briefly yesterday is a requirement that gives the general criteria for the safety classification for ranking the importance to safety First is the safety function to be performed by the item second is the consequences of the failure of this item and See is the frequency the frequency that the item is called to operate and to perform and The third is the time when the item is necessary to perform after the beginning of The event of the initiating event. Okay, so these are the four elements the four Concept that we have to be have to have in mind to rank the importance to safety So this is what we need to know at the beginning Then of course before starting a process of classification You have to think that if he's a new design and you are Producing this this scheme at the beginning is an iterative process. You cannot do everything at the beginning So you define The general aspect of your design you prepare the first scheme of classification then you refine the design and refine the classification you cannot do everything at once but before Starting the safety classification. There is something that you have to know you have to know where you want to go first So what are the radiological releases limits that are established by the regulatory body for all your plant? States that means for operational condition and for different category of accidents You have to have the plant system description description because you have to know how you want to perform the functions What kind of systems you want to use? what kind of components and You have to know exactly what the plant states Are what are your category of accidents for example that we yesterday we talked about normal operation Anticipated operational currencies design basis accident design extension without core melt design extension with core melt So these are your typical plant states that you have to consider because in the plant you will have systems different systems for each of this Plant states and then all of the system shall be classified then what are the initiating events the postulating initiative and Events that you are going to consider Of course, these are linked to the accident To the they are linked to the plant states that you are considering Then you have to know at least a preliminary safety analysis the results of a preliminary safety analysis And how the concept in general the concept of the defense in that is implemented So this is something that you have to have in mind before starting the classification process So any questions so far this I think are very general and the general Point that you are familiar with This is the the classification process That is In our safety standard so this figure is taken exactly from the from the safety standard But I thought they I had the slide on the safety standard. Sorry I thought there was a slide showing we have a we have a safety guide I will tell you briefly is is SSG 30 SSG 30 has been published. I think one or two years ago is quite recent and the title is Safety classification of a structural system and components for nuclear power plant SSG 30 so and The process I am describing now is taken from from this safety guide So you can find this safety guide and the goal is going through this. So sorry, I think I Don't know. I think this is a skipping some of the slides You know what? I don't see the same colors here that are on the screen It's okay, but it doesn't doesn't show the color. So that is the reason. It's okay. So so this is This is our classification process for the moment I think what you have to notice there are two columns here You see okay, this is the starting the starting point the basic understanding these are the concept They just I already I already mentioned to you This is the end of the classification process and we can we have two columns here This is in blue at least on this screen and this in pink. So We I will address first this this line and second this line because here This is the attempt to classify The systems that perform a function the system that deal with a postulated Initiating events. So in this column we are dealing with the emergency core cooling systems with control system with this the other column we are dealing mainly with Structure and components in the nuclear power plant that they prevent Accident like can be the pressure vessel. They can be some shieldings can be some structure, but are not system Intentionally designed to deal with the PAE, but they can Support the other system then I we have some examples. So This can be can be clarified, but we have to have in mind different So these are system with the pumps valves the pipes. There are system big components Normally passive, okay, and so we follow a little bit different Different approach just because it's a way different way to address the to address the function But at the end we classified everything because everything important to safety at the end should be classified So this let's move on Yeah, that is Okay, he's explained there what are the different columns one other system for PAE is and the other that's what we call The provision is not the best term that we could use but it's called provision. So now We address the first part that is the Identification of all the functions to fulfill the main safety functions Because the main safety function are quite general But then to have to perform that function you have to perform several sub functions or more detailed function Okay, so we have to identify All this sub sub sub function necessary to achieve the fundamental safety function one one by one and We have to create a complete list I was done this So you see these are safety function to be identified are those required to achieve the fundamental safety functions For different plant states For accident conditions functions are those that are credited in the safety analysis So you see already the link with With the safety systems at least in this in this left side column of our diagram Also, the fundamental safety function to be fulfilled are the same in each plant states The the more specific safety functions should be identified for each plant state So this should be clear yesterday. We said we have these three fundamental safety functions that the power control the activity Removal of the heat and the confinement We have to achieve this three safety function in normal operation in accident condition and in severe accident Always always we have to control that in a way or another the activity Always we have to remove the heat to stop the degradation of the car always have to be to keep the confinement And we mentioned yesterday That the the success criteria can be different We cannot expect that in a severe accident We have the same success criteria that we have in normal operation for example in the In the heat removal or in the confinement So but so in different plant states we have different way to deal to achieve the safety fundamental functions So we have different systems that perform these functions in each plant state So we have to identify this is it clear So then I think maybe with the example we it helps a little bit So I repeat this the fundamental safety function are the same for all plant states At least the way they are formulated in general terms But the the sub function that are put necessary to perform in each plant state are different. I Removed the heat in in a normal operation with different systems that I used to remove the heat In a severe accident, but at the end I want to remove the heat. This is the concept It is recommended to detail functions as Needed to cover all action to be accomplished by systems in the different plant states So the more complex is your plan the more system you have to perform the function The longer is the list of the the function that you have to produce The number of function is usually small for a conceptual design But is growing, you know, as long as when you are really Refining and your design and defining better your system your systems here is an example an example of a first attempt to subdivide the the fundamental safety function they say in sub function You see on the on the right on the left side you have the you have the fundamental function control of reactivity heat removal confinement on the radioactive material and some additional that is difficult to To correlate directly to this that for example the control of reactivity The function to be categorized for different plant states We are still talking in general for all plant states. Yeah, then we have to refine this further for each plant state For example the control of reactivity is maintaining the core criticality control Shut down and maintain the core sub criticality Prevention of uncontrolled positive reactivity insertion in the core you see the attempt to refine the action that we have to do to achieve that objective and That is really the first Then there will be an further step to further refine this because this sub function can be performed by different systems or Maintain the sufficient sub criticality of fuel store outside the reactor coolant system But within the site. So this is for the critical control of reactivity Then for it removal we do the same Maintain sufficient reactor coolant system water inventory Because you cannot cool if you don't know what so you have The system that take care of Maintaining the right amount of coolant in the system Then remove the heat from the core to the reactor coolant Then you have to transfer the heat from the reactor coolant to ultimate it sink Then maintain a removal for the fuel store outside the reactor core coolant because you have a pool of the fuel So you have to cool also that one So you see it is already from To function you see we already produced eight Subfunction just in the very first screening then For the confinement we have to do exactly the same Maintain the integrity of the fuel cladding because it's the first barrier. So this is the first Thing you have to you have to do then you have to maintain the integrity of the reactor coolant pressure boundary the second barrier Limitation of the releases of radioactive material from the reactor containment limitation of the release of radioactive waste airborne radioactive material And then of course this you have to protect and prevent against the effect of hazard protect all workers against The action re so these are these are sort of general crosscutting. So you see this is the first attempt of course, you know, it's this is Maybe if you attempt by yourself to produce this list of function you have a Little different results. I mean it's not a mathematical But you should really try to to identify Identify very clearly all the function that you have to realize in your plant You have to implement in your plan to achieve each of these So now we are going just to give you some example We are going in a little more detail. Have you seen the the function with we had before or I have this This only for the reactivity. I don't have this developed for the other function, but you see before the we had the The the sub function functions we have identified were this From R1 to R4 core criticality shut down and this so what we are going to do now we are Refined the the achievement of each of these functions So we are determined try to determine what are the sub functions because there are more system that Perform each of these functions. So we are going into more detail of this So we start from R1 and you see R1 is the here maintain the core criticality control And so and then we have R11 R12 and so on and We don't have now to read everything you can you can read by by yourself from the on the slides and But let's at least Go through the first list to give you an idea for example to maintain the core criticality You have to control the reactor coolant system Borek acid Concentration you see we are ready moving in a specific technology because the Borek the Borek acid Concentration is not true for all the for all the kind of plant. There is a typical for For pressurized water react So control the the Borek acid concentration because we have a system in the plant that has this function To control the concentration of the Borek acid so control the road position The control road position of course control the reactor power distribution control the reactor thermal power Control the linear power density Control the pellet cloud interaction risk control the departure from nuclear boring risk Limit the reactor thermal power limit linear power density and so on You see so you see that only for the first Fundamental safety function control over activity you see how many Subfunction we produced already and then we have to do this Also for the heat removal and for the confine So so far we talked only about functions We didn't talk about system, but we have of course there is The concept behind that this function should be performed by something So now we are going to the second step of this we have Now we have already identified a full list of function now we are to to categorize to to say this is Belongs to one category this belong to another category belong to another category So you you start seeing how the process is working So the categorization of the function is a process which is morally system Independent so a technology neutral to some extent not one hundred percent because we have seen we are already talking about Borek acid and this is a specific for some technology, but this the process is general So it can be applied to any to any kind kind of the reactor because we are talking only about function still We that we have not specified what kind of system we put in the reactor to perform that function Can be a passive can be active can be different thing so but for the moment we will concentrate only on the function Then for each postulated initiating event the function necessary to control or mitigate the consequences are identified and categorized The categorization of the function is performed to reflect the safety significance of each function Okay, and the safety significance Is here what are the main factors as before we read in the requirement the consequences of the failure the frequency of occurrence of The postulated event and then the intervention of the systems to deal with this postulated events and the significance of the Contribution of the function in achieving either a control state or a safety state because there are maybe different systems That are working together to reach one of these states. So each one has its own its own function So these are the general criteria to categorize the function So we talk about Consequences we classify according that we categorize I should not use the term classifier so far. We talk about categorization for the function we say we categorize according to the the The consequences so we have to define a scale to measure these consequences And the scheme that is proposed in our standard this one We have three Severity of consequences we are talking one we call high Medium and the law I mean you can use a different scale you can more refine the scale, but this is I think this work This solution works well enough So what is high but when high is that the consequences is high if the Losing that function leads to a release of radioactive material that exceeds the limits for Established by the or accepted by the regulatory body for design basis accident so if you lose a function and Because of this your release is exceeding What is acceptable limit for that range of accident? We say the consequences are I Okay when or The the load the loss of the function causes the value of the key physical parameter that you establish for for the design Basis accident are exceeded we talked yesterday about the maximum temperature of the fuel maximum oxidation Thickness so if you exceed this situation you lose the function and because of this you will you you exceed the acceptance criteria Your consequences are high okay What the consequences are a medium if you leave if the loss of function leads to a release of radioactive material that Exceed the limits established for a whole for operational Correra operational occurrences anticipated operational occurrences or cause the value of key parameters to Exceed the design limits that are established for this plant states, so you are Consequences below the design base is actually what you accept for design base is actually but still higher than the normal operation and they are low if they don't affect the The doses to the population But they can increase a little bit the doses to the workers of the plant So you are really a little above the normal operation, but without affecting the outside population So the so we have this are the the the consequences. So we have this scale high medium and also this is the first attempt to start splitting this set of of Function in different groups So it's quite I mean the the logic is quite simple, but then the implementation is not so simple of this so now we are going the most in the sorry in the most Complicated the part there are a lot of words, but we cannot escape from this if you want I Can go a little faster here if you like, but this is very important because We have how many categories of function we want to split this function in several categories We can say categorization we can decide we can split in three categories Five categories ten categories So we try we tried at the agency to Replicate what is the practice of most member states and most of member states. I mean there are three safety classes So we try to categorize the functions in three categories Because that's if we have three categories of function this will lead to three Classes safety classes if we take four categories of function We will lead to four category for safety classes. So we decide and following I mean the most common practice to split in in three in three categories So let's see now. We don't have to go through everything in detail because we will spend Spend otherwise we will spend most of our time on this, but this this is the fundamental Concept that I try to go to give you and explain to you in in this Presentation so you should consider this very carefully. I mean if you want really to enter in detail in the process So, let's see that the for example the safety category one when we say that the function belongs to category one Is any function that is required to come to reach a controlled state? after an AOO or a DBA and most failure when challenge would result in Consequences of high severity so everything that you do to reach a control state after a Transition AOO or after a DBA And all the function used to reach this control state if they fail and they lead to these high Consequences as we defined before this is a safe function We say this is a safety category one and then to make understanding I put in this Right column at least one example. So it gives you an idea what we are talking about So for example the automatic and fast reactor trip That is something that you have to activate if you are in this situation If this fails if you have an accident and you cannot shut down the reactor you are in a serious Understand that there's a serious problem. So that means the function of this system is Belongs to category one because the importance is very high because if it fails you have very high consequences So this is automatic and fast reactor trip Or this is one case there are two examples here and the second is the core cooling for design basis accident You have designed basis accident you have to cool the system to cool The core because you cannot remove the heat to be the normal operation system You have a dedicated system emergency core cooling the emergency core cooling doesn't work So you could you are going really to a core male situation. So you are going to very high consequences And so the also this system Core cooling for design based action belongs to safety category one So you see how the the system works Let's go for also some Example of safety category to because then become more and more complex You know because safety category one there are few system when you go category two there are more when you go to category two There are even more So it's safety category two any function Requires to reach the controlled state after an AO or after DBA and Who's failure when challenge would the result in consequences of medium severity? So you see the system in the safety category one if they fail go to high Consequences the system in safety category two they are acting in the same situation But if they fail the consequences are lower than before and So these are and then there is any function required to reach a maintained safe state That means stable situation of the plant in the long term This is the meaning of a safe state for a long time and whose failure when challenge would result in consequences of high severity Any function designed to provide a backup Function of a function categorized in a fun in category one because there are some system to perform this Function and there are some backup system is it on work? So normally the backup system belongs to a safety category lower Or a function to the same safety category one and the require to control the deck without core melt Because of course if you have the failure of this You are going in another plant state you have additional fail So you're going to design extension condition So you have a backup system of that to deal with the new plant states and this belongs to a safety class too sorry to a safety category One level below here. There are there are some Examples so for example here is the safety category two is the function Associated with the limiting the off-site releases in design basis accident For example the filter a CAC this is do you know what this is the system for the control of the atmosphere the ventilation heating ventilation and conditioning system and Which failure DBA provided their fellow would not directly read to releases about authorized leave authorized limit Or another example is the residual heat removal in the long term When you're ready the new reactor is shut down is It's cool in part or the pressurizing part and then Is the heat is removed for long term or In case of a deck and this is applicable really to very modern reactor because really few We have a really few example of the Implementation of a diverse actuation trip function as a backup of the reactor trip function So there is a backup of the of the the protection system of the trip function And so you see that is becoming a little complicated, but you cannot expect a simple because the Nuclear power plant is a complex system. There are many functions and you have to classify All component and structure system important to safety and you have thousands of these elements and so They shall be done. So there is no other way. I mean so the the process is rather complicated Of course, you don't have to start this from the scratch every time because this is already Implemented in the practice in the codes that Industrial codes that you are using so is the known technology is not something that you have to invent But so this is to the process that you have to keep in mind Especially if you are addressing something innovative that is not really you don't find in the codes Now there are many ideas of new concept or nuclear power plant that are quite different from the existing with different material really different kind of fuel and so and Is I cannot use just the old scheme and apply without any any critical Review so maybe that is you can accept 90% of an existing scheme But for some system some components you need to create your own classification. So Having a general a general approach. I think is important and then we do the same for for safety category 3 At this is is quite long list. So maybe I skip something and Then you take some time to read quietly maybe on the slides So the safety category 3 any function actuated any event of an AO or DBA or and the whole failure when challenge would result in Consequences of low severity. So here high severity here medium severity and low severity Then function required to reach and maintain state of a long time and whose failure when challenge would result in Consequences of major severity and and so on then if you want an example to see what system we are talking about These are the function designed to prevent the use of safety system in a whole normal auxiliary pressurized spray for the example in In the In the pressure right water reactor service water filtration contain method removal in case of a severe accident So we are going More and more a specific system and system that are less important if they fail the Consequences are not as high as as this one at least in the short term so Important test now to remember that we have we have to create a list of all the function as detailed as we can then we have to group this function at least in three categories and The criteria for putting a function in one category or another are this one These are only part for safety category three three as anticipated, you know, it's more complex because there is really Large number of System so is more complex anyway remember three category three categories of functions so now This is a table that Make a sort of summary what was presented in table before very very complicated, but Is not doesn't cover completely all the cases that are there, but the majority so you see here we have the functions credited in the safety assessment are the function to reach a control state after a whole functions to read the code to reach a controlled state after a DBA functions to reach and maintain safety states This is controlled state and this is a safety state safe state the control state is when we kept We defined it yesterday But just remind you very quickly the control state is a is a state where you can Fulfill at least in for a short time the the fundamental safety function For example, you have the reactor still pressurized still high temperature. So you cannot keep this situation for For days weeks and months This but you keep under control the function Also the reactor in the normal operation is in a controlled state because you control the power you remove the heat And they have the function that in the safest in a safe safe state when you achieve the Fulfill the safety function the fundamental safety function, but you can keep the status for very long time So it's normally the reactor lower temperature Depressurized and these are the the function for the mitigation of consequences of design extension conditions, so we have this situation for functions these are the The the consequences as defined before if we If we fail to meet this function, I see if you see the function to reach a control state for all They have high concept if they produce high consequence they go in safety category one If they produce medium consequence, they go in safety category two if they and in low consequence they Fall in the category three the same the function for DBA if the system that Perform this function fail and produce high consequence the system will be the function is in safety category one the same if it produces Consequences medium falls in safety category two if for produce consequences of low in safety category three and And and so on for the for the design extension conditions They belong they fall if they produce very high consequences Our proposal is to put in safety category one Infra sorry in safety category two or three and If they produce medium and low are not categorized because they are not expected Something in design tension condition you are in the beer severe Situations or expect that you don't produce any consequences is a dream. So so this is not categorized So this is is already Very synthetic way to to present How this function the safety category are related to the function and to the severity of Consequences, I think this is a very important table It gives you the idea So we are very very close to the end of the process because already of the Function we already have these three boxes and we put the function in in these boxes Where are we? now we have to identify The systems the component the structure and component that perform that function because up to now Until now we have the present talk about only functions didn't care what is That the system that perform that function So once the safety categorization of the function is completed the SSC Performing the function should be assigned to a safety class Now we start introducing the safety class because the safety category is related to the function The safety class is related to the component system or structure System are expected to be assigned to a safety class Corresponding to the safety category defined for the function performed. So this is very easy. The first attempt is The system that perform the function that are in category one belong to safety class one The systems or structure component perform the function that are in the category two We say they are safety class two. So the correspondence is very simple category five functional category one Class safety class one two safety class two three safety class three This is the at least as a first attempt. Why I say as a first attempt Because so far we talk only about Consequences we classify the function only on the basis of the consequences But if you remember the criteria There is also frequency So some system can have large consequences if they fail But they don't operate Constantly or daily they operate very rarely and so on the basis of the frequencies This is depends on the approach that you want to follow. We can correct The safety class so we can degrade from a system that is in class two for example Operates very rarely. We can decide on on basis of probabilistic evaluation Probabilistic safety study or other consideration. We can put in a lower class for example class three So but in general I say there is a very direct direct Direct correspondence, so it's that it's not complicated so far very much. I mean it's complicated But it can be followed by the things are not so simple Because some components can have more than one function and in particular There are systems There are system that they have a function to perform a safety function think about ECCS or the or the primary pump the pump in the primary Cooling system or they have to pump the water inject the water somewhere But they have a this is the function they have to deal but they have also function of containing the fluid and avoiding the Release of radioactivity and they are pressurized component So there are two aspects one the functional to Provide the proper flow of fluid the other one to keep the fluid under High pressure avoiding the releases so We have to consider practically that the two possibility one is here in this line here that is the function in performing the Supplying the flow and and the other one here is the confinement or the barrier so the At the end you assign the component even if the component has several functions You have to assign to one safety class So we have to decide what is the most demanding situation? What is the most severe situation? So what is the the highest class if you reach the highest class through this line? Then this the safety class will be determined by this line if you raise it if you reach Higher classification on this line rather than this so at the end the component will be classified according to this So it's clear so you have to consider what is the function of the component that is the most demanding You cannot say this component is safety class 3 for its function and the safety class 2 for the The containing function you say this component is safety class 2. Okay, that is the ways Yes, that is that is the reason we are signed. We are signed always to the most To the highest safety class that we determine in this slide. Yes, right Right perfect Maybe I said wrong, but that is what I intended to say exactly what you said perfect so and you see that for example in in a nuclear power plant when you have a Pressure retaining components like the primary circuit and this System connected to primary circuit all these components are safety class 1 and The safety class 1 is determined by the retaining function more than the you know the process and Providing the flow fluid flow and so on so all these components normally connected that belong to the primary circuit Connected to primers if they are safety class 1 because they have to retain high pressure high temperature fluid Otherwise we release a radiative into the container so this is I Think we almost finish for the at least for the component the component that perform in the Structure system component perform a safety function of the left side of our diagram Yes Yeah, I did know here know that this is limited to the I mentioned only then I will make some consideration later No, it's only for for the the severity of the consequences I just said on the basis of the frequency you can change a little bit You can adjust the safety class because you can decide if a system belongs to class 2 For example with all this process you reach the safety class 2 for that system But this system works with a very low frequency on basis on some probabilistic Consideration you can decide okay. I can degrade to 2 to 3 that is what you can do The but this is is more you based on engineering judgment and probabilistic evaluation But I mean you have to do then here you see when When you have a safety class you reach a safety class Following the skin, but then what you do you have to safety class safety class and the safety classification are important Because to each safety class there are some design rules Uh Linked and different different way to to operate different way to maintain different way to manufacture and to design everything So it's it's very it's very important. So here we start Showing you what we correlate to each safety class and what is related to what are the Consequences to allocate an SSC to a specific safety class These are we are still quite general then we go a little more in particular. It is not complete There are these are some example, but there are other maybe I can mention some that are not here for example here we have the and the first column are the Function this is the emerging the function performed by the emergency core cooling long term Reciduate the removal Containment they produce are some examples So with the the previous analysis we reach that the category of the function for this system Category one for this may be this category two for this is category three This is done on the basis of consequences of their failure so If the system like the emergency core cooling is in category one the function We said that the structure system components are in safety class one If if a system in safety class one is the redundancy Required is the single failure criteria required? Yes So if he's in class one all this system they will be at least redundant They have to be designed according to single failure criteria. I have to have the independence of redundant trains Full independence. Yes Is the physical separation of the redundant trains? Necessary. Yes. So you see from now from from the the safety class We start producing the design rules Still in general still big chunks lay out then we will go in the more detail they are in the manufacturing of And Is the periodic testing required of this system? Yes Is the qualification to environmental condition? Yes, and harsh or mild depend on mild depending on the system location Quality assurance. These are nuclear grade. So that means the highest Available standard. I think is the highest. I don't know maybe there are some technology even higher but at least in the technology we are dealing with is Is the highest level so what we say nuclear grade something is missing from this table, for example the seismic categorization should be This design also for the seismic category one toward here depends how many we have This will be always in the highest category of the seismic categorization And then we can also maybe put some more but you give an idea and of course for for the other when we we go down so The the requirement are becoming less and less stringent So when you think about Components safety class one safety class two safety class three you don't have to think that the component in safety class three is garbage Because it's a component of a very high quality, but maybe you just don't test so frequently You know, it's some design margin are a little lower But these are always that when they are classified are always component of high Quality And for and they are produced and design Manufacturer according a standardized codes. It's not just If something is normal normal technology something that you can buy can buy in a normal store Doesn't belong in this one two three is conventional technology So we are when we are even in class three. We are talking about high quality component That is something to bear in mind because it's class three. So it's nothing No, it's still class three of a classification used for nuclear power plant and and you see then we have a other And you we have other here of the The for the containment Depressurization is in category three so safety class three and redundancy maybe you talk about containment and not for the primary cooling primary System not strictly required, but is normally implemented by several member states in several design And and and so on so when we moved out The moved down from cottage from class one to class three. We have less and less demanding design a requirement and you see when is This function we are outside This and it's function here the function to warn Personnel about the risk of radiation in category three and the quote the category the quality assurance can be commercial grade or Case by case some specific some specific Some specific require you see this is the first attempt to link function classes Quality assurance and the design design some design requirement So this is almost finished. Let's say the left side of our diagram of our flow diagram talking about this system structure and component that perform specific safety function in case of postulating initiating events now we move on the other side. This will be much faster the identification of design provision Important to safety necessary to prevent accident or to protect workers the public environmental against ideological risk So we have to identify first you have to define what this Design provisions are and then we have to follow the process that is similar what we done to the other one But it's much simpler So the safety of the plant is also dependent on the reliability of different type of features Some of which are designed specifically for use in normal operation in the SSC are called design provisions Important because this term is used with different meaning in different documents. So here when we talk about design provision We mean what is in the first statement? Design provision should be identified and may be considered to be subject to the safety classification process and hence will be designed Manufacture, construction, installed, commissioned, operated, tested, inspected, maintained with sufficient quality to fulfill the intended role. Then I have some example so you understand better what is when we talk about design provision You can see here there are there are several examples the design features that are designed to very high quality That their failure could be practically eliminated This design features can be readily identified by the unacceptable level of consequences that can be expected If they should they fail So this concept of practical elimination is Is intuitive but should need to be refined and explained better This will be done on Friday. I think there is a lecture on Friday. So this concept will be explained very well to you so I Think we can avoid and avoid To go in detail An example of this situation is the reactor pressure vessel So the the failure of the vessel the failure in sense of catastrophic failure as explosion of the vessel Is something that should be should not happen Something that is outside of our design basis. So it's an event that we have to practically eliminate So how do we practically eliminate this what we have to do? Of course, we have to design with very large margin very high quality We have to Inspect constantly the vessel. We have to have method to detect if in the vessel there are some flaws We have to be able to follow if these flaws Grows with time We have to know exactly what the mechanism of failure of the vessels are in order that we can prevent this and Then we put some some samples Spicemen inside inside the vessel to measure and to to the effect on of the radiation neutral radiation so so Implementing or this complex set of Of features we say that we can really assume that the Catastrophic failure of the vessel is practically eliminated so we don't have to put provisions in the plant system in the plant to deal with this situation or Explosion of the vessel also because doing this would be almost impossible and so that is the reason So this situation is is is should be practically Eliminated for this reason this component should be designed with the highest standard Of course, this component is know what is not the system to deal with the PAE We call provisions, but nevertheless the reactor pressure vessel If it fails produce the highest consequences, so we have to put in the highest safety class And the same for other the same for other other components that Failure can produce high consequences. Of course, we don't need to practically eliminate we can deal with these consequences But nevertheless we want to avoid as much as possible the failure of these components So we have the feature that sorry The features for example that are designed to reduce the frequency of accident example the piping primary coolant piping very high quality and Because the failure could result in a design basis accident that we want to avoid so also There's piping these components and you cannot pressurize other components will be designed with a very high quality then Passive design feature that are designed to protect the workers and the public form harmful effect of radiation in normal operation for example shield shielding Structure and piping so all these are are provisions that should be identified and should be classified And then passive design feature that are designed to protect components important to safety from being damaged by internal external hazard for example concrete walls between components they have to separate Components from other Features that are designed to prevent postulating discharging event from developing in a more serious consequences for example Anti-whipping device and fixes point in the piping if you break a pipe You want to avoid the pipe we so you put some restraints Against around the pipe. So all these are we don't call these systems We call provisions, but also these are very important and should be classified According to their importance and the classification in this case is strictly based. We don't have to go all these Categorization of function we can go directly from the component to the safety class on the basis of the consequences So what we have here? So we are now in this step the identification classification of this and for this as I said is very easy So we have Three safety classes the safety classes the same as before We put in safety class one any SSC any provision whose failure would directly lead to consequences of high severity vessel of course primary coolant Piping and All the components that we mentioned before safety class to any SSC whose failure would lead to Consequences of medium severity Severate last three those that whose consequences are of low severity for this point We have safety classes for all SSC of our nuclear power plant systems to deal with the PAE we have done before seen before and Provisions just mostly to avoid to prevent accident or to make the consequences less severe So we have this in the scheme as I repeat that we propose is three safety classes plus one non-classified This is reflect the practice on most countries very few countries have four level of Safety classes for safety classes, but mostly have three string. Okay What do you mean to have to you you you put this this feature as necessary No, because you've seen in the in the table before no not necessarily No, not necessarily. Yeah. Yeah, not necessarily No, these are these are components it depends what is the consequences always on the basis of the consequences or the basis of consequence because these are not The importance of the Anti-whipping is not the same as that the reactor vessel. You cannot assume that is the same You know you have on the basis of the consequences if you there are the consequences if you don't know if this fails Is the consequence I medium or low on this basis you put in one two three just on the basis of the consequences Yeah, but it is you know, it's the is the The process complicated because you know some system of different functions Not only one function or a structure for example support can support the same the same concrete wall Can support components of different? Importance, so you have to consider this So you have to always to think the About what is the highest safety class of the component that is interfacing with the structure for example? So I'm not saying that is a simple. This is a complex and it's still controversial not everybody agrees on everything for example when we prepare the we prepare the the safety guide and we wanted to have a more detail least of design Consequences that we want to associate to each safety class some member state did not agree because they have They forced us to stay in a more general Skin because you know when you reach this point then there are different approaches and different technical solution in different member states It's not exactly the same for example in the United States the in United States the The emergency core cooling system is class safety class to know our system is safety class one at least as a first Ranking then maybe can move to safety class to just because of the low frequency of Of use of this It's different and I know for example you have someone from Ukraine Russia and The Russian Classifications is the modern the latest Russian classification safety class Is only for the vessel for this that you have for those components the failure of which has to be practically Minate for which you don't have you don't have mitigation features and then the other they start from class 2 It's a different button ended the idea is always the same but at the end if you look how They designed the vessel that is safety class one and let us say The piping for example the primary circuit is safety class 2 and In our scheme is safety class one But at the end the codes the design code associated at the same So it's not important if you call safety class 2 or safety class 1 important is what you link to its safety class What you do in design and manufacturing of components of a specific class So there are differences, but I think the scheme that we proposed at the agency of course Was a long work to prepare this and to reach agreement on this is quite general and give an idea What is really behind behind the classification? What is the rationale? So I think this is what I wanted to show you this morning, but so let's Little more information We have seen so what we want You see this is I think a diagram that we have seen under times is a correlation between the the frequency of event and the Consequences so what we want to achieve in the designer these events that have high Frequency they are called frequently they produce low consequences the events that have low Very high Consequences should occur with a very low frequency is a sort of curve that is Shows the risk the risk in the intended as the product of consequences for For frequency these are almost constant. So we have two fields here one is the acceptable if the they say that the consequences and and the frequency Fall in this area is acceptable the situation is in this area is not acceptable and Improving the function of this system the capability of this system. We reduce the consequences putting design provision like Improving the quality of our material like the quality of the vessel the quality of the primary cool We reduce the frequency of initiating event because if your piping system is designed with higher standard The frequency of failure is lower obviously. So you see how the improving the quality of system and quality of provision you can move From one area to another all this. So this is a concept that is Something that you know before we talked about that we have to take into consideration in the classification the consequences and the frequency and We do this just to have equilibrate distribution of risk So in basis of the basis of some probabilistic consideration You can adjust to the safety class of some of some of your components So this is also something a general concept that is important to keep in mind What we have here now? We have some example of Specific design codes that are associated to each safety class There are several examples. We don't have time to read all of this Because there are also very long comments, but you you will have this slide and and You can have a look and the reference made here is to the most common Design code from the nuclear technology at least is for mechanical components the table Then I have another one for electrical components You see the reference it is to ask me code I think everybody of you knows what has me is As we call this is American set of codes produced by the Association of Mechanical Engineering in In the United States and I think is the most the most diffuse the most used code for design or nuclear Nuclear components and all other codes that have been produced later They took inspiration from this. They were the first and the more the more detailed it used practically by Everybody I think there is no designer in the world that doesn't consider taking to consideration. They asked me code the other one is the RCC this is a French French code also this set of codes now that French are using for their for their design are based I Would say 95% even more on us may code with some Modification because the design are different so they adapted something but is practically is based on us may code M RCC M M stands for mechanical and the RCC electrical and So this is just to see so if I have a component in safety class one a Mechanical component that is a function of retaining pressure How will I design it? you see here the The safety classified pressure retaining component design provision was failure in normal operation would directly lead to high Consequences of these are that is the reason we put in class one in our process Is an example of code so I go into ask me code section 3 division one subdivision and be so it's rather calm but ask me code is something huge that is a know if you have the chance to To go into it's a very detailed very huge Unfortunately, it's not available for free on the on the web you have to buy if you want to consult the other ask me code unless you have some agreements may be with us with an RC and So you see you go in this code and these codes are very detailed if you have designed up to design a pipe You know once you there's a way to define the design pressure when you have the design pressure You have a way to select the material when you select the material how you calculate the thickness So there are how you have to make the welding what is process so everything is in there everything so That is most that everybody is designed at the main major components. We follow in the same the same code summons vessel design in Japan or vessel design United States vessel design in France at the end is practically the same product or very similar and So here there are some example that fall in this and here there are some comments that give you additional information, but that is So let's try to be a little faster. Just I want to show what what we have here As it is a continuation because there are also other components that are following in this category Then we move to safety class to of course Other components that we are in safety class to and then we change You see the ask me code is section to this one subsection and see and the French standard goes from M1 to M2 So it's a different standard that gives you the again a set of rules to design to manufacture to test everything you need to do to to produce at the end a component that can be considered in safety class true always for me always still for mechanical Mechanical components then we have a safety class three following the same so you see as many becoming section And the LCC is becoming M3 Example of what? No, well, I cannot I'm not first time representing the agency and then I don't know the Russian code so well So really I don't know I know in general maybe someone of the participant can can What I remember because for some reason for my profession I had to go through the the Russian requirements I think it's called OPP 87 that was produced after Chernobyl and was so was really revisiting the Russian requirement in this in this requirement the the Russian they have the Implemented the same concept of defense in depth that We have we prepared at the agency and they propose also a scheme of classification and What I know And maybe other colleagues know more on this that that they have four safety classes and one Non-classified the first safety classes is only for components The consequences of the failure of which cannot be mitigated with anything you have in the plant So it's something that you have to practically me name and I think is only the pressure vessel for the PWR and the pressure riser Then safety class 2 is what in our case is safety class 1 component the primary cooling for example and then safety the safety class 3 I Think is equivalent to the safety class through 2 and the safety class 4 in Russia is Equivalent to the safety class 3 in our scheme, so they are just switched like this So if you say what is in Russia safety class 3? I have tempted to say is what in our scheme is safety class 2 Okay, but this I cannot be 100 percent Confident in all cases T board maybe you can add something on this, you know this better Well, let's talk about more than because also what I mean as you all does another another problem Still, I don't know how to switch on this Oh, you have to keep the press this So what I wanted to say is that they In Russia they have their own standard systems and all the Requirements are related to those standards, but if The plant is built somewhere else outside Russia or In other countries in many cases there is a requirement to show the correspondence of the Russian requirements to to the international Standards and in most of the cases it can be shown very easily so the safety classification is Very similar to I mean not similar it is what what you mentioned as far as I know because what we We are We're trying to make a correspondence between the the Hungarian Regulation and a Russian classification if it makes some difficulty for us because We For the new plants. We are applying also the IEA swim Okay, so You should physically that's what I I can add to this Okay, thanks so let's Try to conclude with it. Oh, wow took a long time The here in this table and maybe the colleague maybe next day tomorrow We'll maybe more be more specific. These are example similar But these are referred to the to the electrical components I and C and the electrical components and this case is the Also, we have this safety classes and the associated code are normally what are the IEEE from United States or the RCC Electric In France, so these are codes for different different safety classes and in this column In this call in this column here Yes, you have some example Example of systems that fall in each of this of this category and And some comments so the I'm I'm I think the methodology is the same but in the end The codes used for the design in manufacturing and testing are of course Different different codes, but this the process is exactly the same. Okay, so Was a long long discussion and I think many concepts. I hope that You are able to retain something and have a better idea what the classification is So we have still two minutes if there is some questions that I can answer